Legal
Privacy policy
Last updated: 28 May 2026
Superboosted Design ("we", "us", "our") is a web design agency based in Wellington, New Zealand. This policy explains how we collect, use, and protect your personal information when you use superboosted.design.
We are committed to protecting your privacy in accordance with the New Zealand Privacy Act 2020. We also comply with the EU General Data Protection Regulation (GDPR) for visitors from the European Economic Area, and respect the California Consumer Privacy Act (CCPA) for visitors from California.
What information we collect
Contact form
When you submit an enquiry through our contact form, we collect your name, email address, and the contents of your message.
Analytics
We use analytics tools (such as Google Analytics) to understand how visitors use our website. This may include your approximate location, device and browser type, pages visited, and time spent on the site. This data is aggregated and used to improve our website. Google Analytics may set cookies in your browser — see the Cookies section below.
Payments
If you engage us for services, we collect billing information such as your name, email address, and payment details. Payment card data is processed securely by Stripe and is not stored on our systems.
How we use your information
We use your information to:
- Respond to your enquiries and provide our services
- Send you project updates, invoices, and other communications related to your engagement with us
- Improve our website and understand how visitors use it
- Meet our legal and financial obligations
We do not sell, rent, or share your personal information with third parties for marketing purposes.
Legal basis for processing (GDPR)
If you are located in the European Economic Area, we process your personal information on the following legal bases:
- Contact form data — processing is necessary to take steps at your request prior to entering a contract, or to perform a contract with you (Article 6(1)(b) GDPR)
- Analytics data — processing is based on our legitimate interest in understanding how our website is used and improving it (Article 6(1)(f) GDPR)
- Payment data — processing is necessary to perform a contract with you (Article 6(1)(b) GDPR)
International transfers
Superboosted Design is based in New Zealand. New Zealand has been granted adequacy status by the European Commission, meaning the EU recognises New Zealand privacy law as providing an equivalent level of protection to GDPR. No special transfer mechanisms are required for personal data transferred from the EEA to us.
Our third-party providers (Google Analytics and Stripe) may process data in other countries. Please refer to their respective privacy policies for details.
Third-party services
We use the following third-party services that may process your data:
- Google Analytics — website analytics (Google Privacy Policy)
- Stripe — payment processing (Stripe Privacy Policy)
These providers have their own privacy policies and are responsible for their own data practices. We encourage you to review their policies.
Cookies
Our website uses cookies to support analytics. A cookie consent banner is displayed on your first visit — Google Analytics cookies are only loaded if you choose to accept. You can change your preference at any time by clearing your browser's local storage. No cookies are used for advertising or cross-site tracking purposes.
Data retention
We retain contact form enquiries and client information for as long as necessary to provide our services and meet our legal obligations. If you would like us to delete your information, see Your rights below.
Your rights
Depending on where you are located, you may have some or all of the following rights regarding your personal information:
- Access — request a copy of the information we hold about you
- Correction — ask us to correct information that is inaccurate or incomplete
- Erasure — ask us to delete your information (the "right to be forgotten"), subject to any legal obligations we have to retain it
- Restriction — ask us to restrict how we process your information
- Portability — request your data in a portable, machine-readable format
- Objection — object to our processing of your information where we rely on legitimate interests as the legal basis
- Complaints — if you are in the EEA, you have the right to lodge a complaint with your local data protection supervisory authority
To exercise any of these rights, contact us at the address below. We will respond within 30 days.
California residents (CCPA)
We do not sell personal information. If you are a California resident, you have the right to know what personal information we collect about you, request deletion of your information, and not be discriminated against for exercising your privacy rights. To make a request, contact us at the address below.
Security
We take reasonable steps to protect your personal information from loss, unauthorised access, and disclosure. Payment data is handled exclusively by Stripe using industry-standard encryption.
Changes to this policy
We may update this policy from time to time. The date at the top of this page reflects when it was last revised. Continued use of our website after any changes constitutes acceptance of the updated policy.
Contact
If you have any questions about this policy or how we handle your information, please get in touch: